Large language model-powered sequential recommender systems (LLM-SRSs) have recently demonstrated remarkable performance, enabling recommendations through prompt-driven inference over user interaction sequences. However, this paradigm also introduces new security vulnerabilities, particularly text-level manipulations, rendering them appealing targets for promotion attacks that purposely boost the ranking of specific target items. Although such security risks have been receiving increasing attention, existing studies typically rely on an unrealistic assumption of access to either the victim model or prompt to unveil attack mechanisms. In this work, we investigate the item promotion attack in LLM-SRSs under a more realistic setting where both the system prompt and victim model are unknown to the attacker, and propose a Prompt-Unknown Dual-poisoning Attack (PUDA) framework. To simulate attacks under this full black-box setting, we introduce an LLMbased evolutionary refinement strategy that infers discrete system prompts, enabling the training of an effective surrogate model that mimics the behaviors of the victim model. Leveraging the distilled prompt and surrogate model, we devise a promotion attack that adversarially revises target item texts under semantic constraints, which is further complemented by the highly plausible, surrogategenerated poisoning sequences to enable cost-effective target item promotion. Extensive experiments on real-world datasets demonstrate that PUDA consistently outperforms state-of-the-art competitors in boosting the exposure of unpopular target items. Our findings reveal critical security risks in modern LLM-SRSs even when both prompts and models are protected, and highlight the need for more robust defensive means.

Soft Actor-Critic (SAC) and other off-policy reinforcement learning methods have emerged as powerful tools for complex dynamic decision-making. However, they are susceptible to detrimental Q-value overestimation bias in stochastic environments. This bias critically impairs policy optimization, propagates estimation errors, and can lead to suboptimal policies. To address this challenge, we introduce Soft Actor-Critic with Bias (SAC-B), a novel framework designed to mitigate Q-value overestimation while preserving the strengths of maximum entropy RL. SAC-B incorporates a dynamic bias compensator, implemented as a learnable network, to heuristically counter Q-value overestimation. Crucially, we employ an error-decoupled stabilized architecture that isolates this bias prediction module from the critic networks, thereby eliminating error propagation and enhancing stability. Furthermore, SAC-B utilizes a hybrid objective function that strategically balances temporal difference learning with entropy regularization, enabling rapid adaptation. These synergistic components collectively enable SAC-B to effectively reduce temporal bootstrapping errors while maintaining the desirable exploration properties of the original SAC algorithm. Experiments across six continuous control benchmarks, including BipedalWalkerHardcore-v3 and Quadruped, validate the superiority and enhanced stability of our approach compared to existing methods.

The marriage of federated learning and recommender system (FedRec) has been widely used to address the growing data privacy concerns in personalized recommendation services. In FedRecs, users’ attribute information and behavior data (i.e., user-item interaction data) are kept locally on their personal devices, therefore, it is considered a fairly secure approach to protect user privacy. As a result, the privacy issue of FedRecs is rarely explored. Unfortunately, several recent studies reveal that FedRecs are vulnerable to user attribute inference attacks, highlighting the privacy concerns of FedRecs. In this paper, we further investigate the privacy problem of user behavior data (i.e., user-item interactions) in FedRecs. Specifically, we perform the first systematic study on interaction-level membership inference attacks on FedRecs. An interaction-level membership inference attacker is first designed, and then the classical privacy protection mechanism, Local Differential Privacy (LDP), is adopted to defend against the membership inference attack. Unfortunately, the empirical analysis shows that LDP is not effective against such new attacks unless the recommendation performance is largely compromised. To mitigate the interaction-level membership attack threats, we design a simple yet effective defense method to significantly reduce the attacker’s inference accuracy without losing recommendation performance. Extensive experiments are conducted with two widely used FedRecs (Fed-NCF and Fed-LightGCN) on three real-world recommendation datasets (MovieLens-100K, Steam-200K, and Amazon Cell Phone), and the experimental results show the effectiveness of our solutions.